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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Listing of Claims: 

1 . (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a [[A]] method for monitoring a 
process, the method comprising: 

creating a signature representative of the process; 

continuously updating the created signature with a weighting scheme; and 
detecting abnormalities based upon the continuously-updated signature, 
wherein the process is related to usage of networked computing devices in 
a datacenter, 

wherein the signature includes information related to time- sensitive 
averaging that accounts for variation in a business cycle,-and 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight[[,]] 

wherein creating a signature comprises accelerated learning through 
setting a learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 
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2. (Currently Amended) Th e method media of claim 1, wherein creating a 
signature comprises calculating an average and a standard deviation. 

3. (Canceled). 

4. (Currently Amended) Th e method media of claim 2, wherein creating a 
signature comprises initially repeating a running average and standard deviation through a 
plurality of intervals. 

5. (Currently Amended) The m e thod media of claim 1, wherein updating the 
created signature comprises ensuring that recently-recorded data has a greater impact than older 
data by setting the second weighting factor to a value greater than the first weighting factor. 

6. (Currently Amended) The method media of claim 1, wherein updating the 
created signature comprises utilizing a moving average over a time to account for events 
occurring at unexpected times. 

7. (Currently Amended) The method media of claim 1, wherein detecting 
abnormalities comprises determining if measured values are above an upper threshold or below a 
lower threshold. 

8. (Currently Amended) The method media of claim 1, further comprising 
calculating upper and lower threshold limits based on jitter offset. 

9. (Canceled). 
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10. (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a [[A]] method for detecting 
abnormalities occurring during a process based upon a continuously updated signature 
representative of the process, the method comprising: 

creating a signature representative of the process, 

continuously updating the created signature with a weighting scheme; 

continuously monitoring a system parameter; 

computing a normal range of values for the system parameter based on the 
continuously-updated signature; 

determining if the monitored system parameter is within the normal range; 

and 

indicating existence of an abnormality if the monitored system parameter 
is outside of the normal range, 

wherein the process is related to usage of networked computing devices in 
a datacenter,-and 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight[[,]] 

wherein creating a signature comprises accelerated learning through 
setting a learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 
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11. (Currently Amended) Th e metho d media of claim 10, further comprising 
creating a signature by calculating an average and a standard deviation. 

12. (Canceled). 

13. (Currently Amended) The method media of claim 11, wherein creating a 
signature comprises initially repeating the running average and standard deviation through a 
plurality of intervals. 

14. (Currently Amended) The method media of claim 10, wherein computing 
a normal range of values comprises ensuring that recently-recorded data has a greater impact 
than older data by setting the second weighting factor to a value greater than the first weighting 
factor. 

15. (Currently Amended) The method media of claim 10, wherein computing 
a normal range of values comprises utilizing a moving average over a time to account for events 
occurring at unexpected times. 

16. (Currently Amended) The — method media of claim 10, wherein 
determining whether a monitored system parameter is within a normal range of values comprises 
determining if monitored system parameters are above an upper threshold or below a lower 
threshold. 

17. (Currently Amended) The method media of claim 16, further comprising 
calculating upper and lower threshold limits based on jitter offset. 

18. (Canceled). 
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19. (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a [[A]] method for creating a 
signature useful for detecting abnormalities in a computing system environment, the method 
comprising: 

setting a learning responsiveness ratio; 
monitoring a system parameter; 

adjusting the learning responsiveness ratio at fixed intervals until a desired 
value is reached; 

calculating an average and standard deviation for each interval; and 
using the average, standard deviation and learning responsiveness ratio to 

create the signature, 

wherein the learning responsiveness ratio is equated to a weighting factor 

that represents current data divided by a weighting factor that represents the 

signature, 

wherein the abnormalities in the computing system environment relate to 
usage of networked computing devices in a datacenter, and 

wherein the signature includes information related to time- sensitive 
averaging that accounts for variation in a business cycle. 

20. (Currently Amended) The method media of claim 19, further comprising 
continuously updating the created signature through a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight. 
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21. (Currently Amended) The method media of claim 20, further comprising 
detecting abnormalities based on the updated signature. 

22. (Currently Amended) The m e thod media of claim 19, wherein creating a 
signature comprises initially repeating the running average and standard deviation through a 
plurality of intervals. 

23. (Currently Amended) The method media of claim 20, wherein updating 
the created signature comprises ensuring that recently-recorded data has a greater impact than 
older data by setting the second weighting factor to a value greater than the first weighting 
factor. 

24. (Currently Amended) The method media of claim 20, wherein updating 
the created signature comprises utilizing a moving average over a time to account for events 
occurring at unexpected times. 

25. (Currently Amended) The method media of claim 21, wherein detecting 
abnormalities comprises determining if measured values are above an upper threshold or below a 
lower threshold. 

26. (Currently Amended) The method media of claim 21, further comprising 
calculating upper and lower threshold limits based on jitter offset. 

27. (Canceled). 

28. (Currently Amended) A computerized system including one or more 
computer storage media medium for detecting abnormal activity in a computerized environment, 
the system comprising: 
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monitoring tools stored on the computer storage media for continuously 
monitoring a system parameter; 

a continuously updated signature representative of typical values of the 
system parameter 

an abnormality indicator calculated based on the continuously updated 
signature, the abnormality indicator including a range of typical values for the 
system parameter, 

wherein the signature is continuously updated with a weighting scheme, 

wherein the weighting scheme consists of a first weighting factor 
representing the weight of the continuously-updated signature and a second 
weighting factor representing the weight of current data, 

wherein the abnormal activity is related to abnormal usage of networked 
computing devices in a datacenter,-and 

wherein the signature includes information related to time — sensitive 
averaging that accounts for variation in a business cycle[[,]] 

wherein the signature is created by accelerated learning through setting a 
learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 

29. (Previously Presented) The system of claim 28, wherein the continuously- 
updated signature comprises an average and a standard deviation. 
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30. (Previously Presented) The system of claim 28, wherein the continuously 
updated signature comprises the second weighting factor having a greater value than the first 
weighting factor to ensure that recently recorded data has a greater impact than older data. 

31. (Previously Presented) The system of claim 28, wherein the continuously 
updated signature comprises a moving average over time to account for events occurring at 
unexpected times. 

32. (Original) The system of claim 28, wherein the abnormality indicator 
determines whether a monitored system parameter is within a normal range of values and 
whether monitored system parameters are above an upper threshold or below a lower threshold. 

33. (Original) The method of claim 28, wherein the abnormality indicator 
calculates upper and lower threshold limits based on jitter offset. 

34. (Currently Amended) A computerized monitoring system including one or 
more computer storage media medium for monitoring a process, the monitoring system 
comprising: 

a signature creation module , stored on the one or more computer storage 
media, for creating a signature representative of the process; 

a signature updating module , stored on the one or more computer storage 
media, for continuously updating the created signature; and 

an abnormality detection module , stored on the one or more computer 
storage media, for detecting abnormalities based upon deviations from the 
updated signature, 

wherein the signature is continuously updated with a weighting scheme, 
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wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight, 

wherein the signature creation module comprises tools for performing 
accelerated learning through incrementally increasing a learning responsiveness 
ratio until the learning responsiveness ratio reaches a desired value, 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor, 

wherein the process is carried out on a computer and is related to usage of 
networked computing devices in a datacenter, and 

wherein the signature includes information related to time sensitive 
averaging that accounts for variation in a business cycle. 

35. (Original) The system of claim 34, wherein the signature creation module 
includes tools for calculating an average and a standard deviation. 

36. (Canceled). 

37. (Original) The system of claim 35, wherein creating a signature comprises 
initially repeating the running average and standard deviation through a plurality of intervals. 

38. (Previously Presented) The system of claim 34, wherein the signature 
updating module comprises tools for ensuring that recently-recorded data has a greater impact 
than older data by setting the second weighting factor to a value greater than the first weighting 
factor. 
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39. (Original) The system of claim 34, wherein the signature updating module 
comprises tools for calculating a moving average over a time to account for events occurring at 
unexpected times. 

40. (Original) The system of claim 34, wherein the abnormality detection 
module determines if monitored system parameters are above an upper threshold or below a 
lower threshold. 

41. (Original) The method of claim 34, wherein the abnormality detection 
module includes a mechanism for calculating upper and lower threshold limits based on jitter 
offset. 

42. (Currently Amended) One or more computer storage media having 
computer-useable instructions embodied thereon for performing a [[A]] method for 
distinguishing between normal and abnormal behavior during a process, the method comprising: 

creating a signature representative of the process, 

continuously updating the created signature with a weighting scheme; 

monitoring a system parameter; 

converting a numeric data stream representative of the monitored system 

parameter to a state for the process; and 

distinguishing between normal and abnormal behavior based on the state, 
wherein the process is related to usage of networked computing devices in 

a datacenter, 

wherein the weighting scheme consists of a first weighting factor that 
represents a continuously-updated signature weight and a second weighting factor 
that represents a current data weight, 
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wherein the system parameter includes at least one of a usage variable, 
utilization, an error, and turn around time,-and 

wherein distinguishing between normal and abnormal behavior includes 
utilizing time sensitive averaging to account for variation in a business cycle[[,]] 

wherein the signature is created by accelerated learning through setting a 
learning responsiveness ratio and incrementally increasing the learning 
responsiveness ratio until the learning responsiveness ratio reaches a desired 
value, and 

wherein the learning responsiveness ratio is equated to the second 
weighting factor divided by the first weighting factor. 

43. (Currently Amended) The method media of claim 42, further comprising 
converting the numeric data streams to multiple sub-states. 

44. (Currently Amended) The method media of claim 42, further comprising 
determining a root cause of an abnormality based on the state. 
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